PpmEventIdleDurationExpiration

void __fastcall PpmEventIdleDurationExpiration(unsigned __int16 *a1, __int64 a2, EVENT_DESCRIPTOR *a3){
  unsigned __int16 v4; 
  unsigned __int16 v5; 
  unsigned __int16 v6; 
  __int64 v7; 
  __int64 v8; 
  unsigned int v9; 
  __int64 *v10; 
  __int64 v11; 
  __int64 v12; 
  __int64 v13; 
  UINT64 UserDataCount; 
  unsigned __int16 v15; 
  EVENT_DATA_DESCRIPTOR UserData[41]; 
  __int64 v17[40]; 
  if( PpmEtwRegistered && EtwEventEnabled(PpmEtwHandle, (EVENT_DESCRIPTOR *)&PPM_ETW_IDLE_DURATION_EXPIRATION, a3) )
  {
    v4 = *a1;
    v5 = 0;
    v6 = 0;
    v15 = 0;
    do
    {
      v7 = 2i64 * v5;
      *(_OWORD *)&v17[v7] = 0i64;
      LOWORD(v17[v7 + 1]) = v6;
      if( v6 >= v4 )
        v8 = 0i64;
      else
        v8 = *(_QWORD *)&a1[4 * v6 + 4];
      v17[2 * v5] = v8;
      if( v8 )
        ++v5;
      ++v6;
    }
    while( v6 < 0x14u );
    v15 = v5;
    UserData[0].Ptr = (unsigned __int64)&v15;
    *(_QWORD *)&UserData[0].Size = 2i64;
    v9 = 1;
    if( v5 )
    {
      v10 = v17;
      v11 = v5;
      do
      {
        v12 = v9;
        UserData[v12].Ptr = (unsigned __int64)(v10 + 1);
        *(_QWORD *)&UserData[v12].Size = 2i64;
        v13 = v9 + 1;
        v9 += 2;
        UserData[v13].Ptr = (unsigned __int64)v10;
        v10 += 2;
        *(_QWORD *)&UserData[v13].Size = 8i64;
        --v11;
      }
      while( v11 );
    }
    LODWORD(UserDataCount) = v9;
    EtwWriteEx(
      PpmEtwHandle,
      (EVENT_DESCRIPTOR *)&PPM_ETW_IDLE_DURATION_EXPIRATION,
      0i64,
      0i64,
      0i64,
      0i64,
      UserDataCount,
      UserData);
  }
}

Referenced by:

PoExecuteIdleCheck